Introduction to AWS Networking

Key Concepts

• AWS Networking
• VPC (Virtual Private Cloud)
• CIDR (Classless Inter-Domain Routing)
• Internet Gateway (IGW)
• Subnets (Public and Private)
• Route Tables
• NAT (Network Address Translation)
• Site-to-Site VPN
• Direct Connect
• Client VPN
• VPC Peering
• Transit Gateway
• VPC Endpoints (Gateway and Interface)
• Private Link
• Route53
• CloudFront
• Availability Zones (AZ)
• Elastic Network Interface (ENI)

1. Introduction to AWS Networking

• AWS networking is crucial for application scalability and security implementation at different OSI model layers (Layer 3 to Layer 7).
• The lecture provides an overview of AWS networking services, focusing on their roles in architecture design rather than in-depth explanations of each service.
• Understanding AWS networking is essential for developers, DevOps engineers, and network administrators, each requiring different levels of expertise.

2. Networking Knowledge Based on Roles

• Developers: Should know VPC basics, including VPC address space, CIDR, Internet Gateway, subnets, route tables, IP addresses, and firewalls (Security Groups and Network ACLs). They should also be familiar with Load Balancer, CloudFront, Route 53 (DNS service), VPC Endpoints, Private Link, and VPC Peering.
• DevOps Engineers: Need a broader understanding, including Transit Gateway, Transit VPC, Site-to-Site VPN, Client VPN, and network automation using CloudFormation or AWS CLI. They should also be able to capture, log, and monitor network traffic.
• Network Administrators: Require in-depth knowledge of AWS Direct Connect, advanced VPC features, enhanced networking (up to 25 Gbps bandwidth between EC2 instances), hybrid connectivity, network performance optimization, and network security at Layer 3 (DDoS protection) and Layer 7.

3. VPC Fundamentals

• A VPC is an isolated private network within AWS where users control inbound and outbound traffic.
• VPC scope is region-level, allowing the use of any Availability Zone (AZ) within the region.
• Every VPC has a private IP address range defined by CIDR.
• A default local router routes traffic within the VPC.
• The main route table contains an entry for the VPC's CIDR, targeting the local router, enabling communication between EC2 instances within the VPC.

4. Subnets and Availability Zones

• Subnets are created within a VPC to launch EC2 instances.
• To leverage multiple AZs for high availability, subnets should be created across different AZs.
• One subnet can only reside in one AZ at a time, but one AZ can contain multiple subnets.
• Subnets are assigned CIDR blocks, which are smaller address spaces than the VPC's CIDR.

5. Public vs. Private Subnets

• By default, subnets are private, meaning they cannot directly communicate with the internet.
• An Internet Gateway (IGW) is attached to the VPC to enable internet communication.
• A public subnet is defined by its route table having an entry for internet-bound traffic (0.0.0.0/0) directed to the IGW. Web servers and bastion hosts typically reside in public subnets.
• Private subnets lack a direct route to the internet and are used for resources like databases and application servers that should not be publicly accessible.
• Dedicated route tables for subnets allow fine-grained control over traffic flow.

6. Example Architecture: fb.com

• A load balancer resides in public subnets across multiple AZs for high availability. AWS manages the underlying infrastructure for the load balancer.
• Web/app servers are placed in private subnets with only private IP addresses, receiving traffic from the load balancer.
• The master database is in one AZ, with a standby replica in another AZ for fault tolerance, utilizing synchronous replication due to low latency between AZs (less than 10 milliseconds).
• User traffic flows from the internet to the load balancer, then to web/app servers, and finally to the database.

7. Network Address Translation (NAT)

• EC2 instances in private subnets cannot directly access the internet or be accessed from the internet.
• NAT devices in public subnets enable outbound internet access for EC2 instances in private subnets.
• Traffic from EC2 instances is routed to the NAT, which then forwards it to the internet and routes the response back to the EC2 instance.
• The route table of the private subnet must have an entry directing internet-bound traffic to the NAT.

8. Hybrid Connectivity: Site-to-Site VPN and Direct Connect

• Hybrid connectivity is needed when some workloads run on-premises and others in AWS.
• Site-to-Site VPN: Connects on-premises networks to AWS VPCs over the internet using a virtual private gateway (VGW) on the AWS side and a customer gateway (router) on the on-premises side. IPSec VPN tunnels provide secure, encrypted communication. AWS supports two tunnels for high availability. However, traffic still flows over the internet, which may not provide consistent bandwidth.
• Direct Connect: Establishes a dedicated, private network connection between on-premises infrastructure and AWS. AWS Direct Connect locations are connected to AWS regions via high-speed, low-latency optical fibers (up to 100 Gbps). Customers connect their on-premises networks to these locations, obtaining consistent bandwidth (1 Gbps to 10 Gbps).

9. Client VPN

• Client VPN allows individual users to securely connect to an AWS network from remote locations.
• Users connect to a Client VPN endpoint using an OpenVPN client, becoming part of the network and accessing resources as if they were on-site.
• Requires creating subnets within the VPC that become part of the Client VPN network.

10. VPC Peering

• VPC peering enables direct network connectivity between two VPCs using private IP addresses, without traversing the internet.
• Traffic flows over the AWS-managed backbone network.
• VPCs can be in the same or different AWS accounts and regions.
• VPC peering is non-transitive, meaning a direct connection is required between each pair of VPCs.

11. Transit Gateway

• Transit Gateway simplifies network architecture when dealing with numerous VPCs.
• It acts as a hub, allowing spoke VPCs to connect to it and communicate with each other, as well as with corporate data centers connected via VPN or Direct Connect.
• Transit Gateway provides a complete mesh network, simplifying routing and management compared to VPC peering in large environments.

12. VPC Endpoints

• VPC Endpoints enable private connectivity to AWS services like S3 and DynamoDB, without using the internet.
• Traffic flows through the VPC Endpoint, avoiding reliance on NAT devices and internet bandwidth limitations.
• VPC Endpoint Gateway: Used for S3 and DynamoDB.
• VPC Endpoint Interface: Used for other AWS services (SQS, CloudWatch, SNS, SES), creating an Elastic Network Interface (ENI) in the subnet to route traffic.

13. Private Link

• Private Link allows service providers (e.g., SaaS vendors) to privately expose their services to customers' VPCs.
• The service provider exposes a Network Load Balancer (NLB) through a Private Link, allowing customers to access the service via a VPC Endpoint Interface.
• This provides a service-level connection, rather than opening up the entire network, and can be used to expose services to thousands of VPCs.

14. Route53

• Route53 is AWS's DNS service, used to manage domain names and route traffic to applications.
• It allows users to access applications using domain names (e.g., example.com) instead of IP addresses.
• Route53 returns the IP address of the load balancer or other endpoint when a user requests the domain name.

15. CloudFront

• CloudFront is AWS's Content Delivery Network (CDN), used to cache static content (videos, images) at edge locations around the world.
• Edge locations are connected to the AWS backbone network, reducing latency for users.
• Route53 can be configured to return the IP address of a CloudFront edge location, directing users to the nearest cache.
• S3 buckets or load balancers can be used as the origin for CloudFront distributions.

16. Conclusion

The lecture provides a comprehensive overview of AWS networking services, covering VPC fundamentals, hybrid connectivity options, VPC peering, Transit Gateway, VPC Endpoints, Private Link, Route53, and CloudFront. It emphasizes the importance of understanding these services for building scalable, secure, and highly available applications on AWS. The lecture also highlights the different levels of networking knowledge required for developers, DevOps engineers, and network administrators.